A new survey finds that a large number of European companies haven’t planned for cyberattacks, which may shed some light on why so many are getting hacked.

Just one-quarter of companies surveyed said they have a “clear understanding” of their “exposure to cyberrisk,” according to the European Cyber Risk Survey released this month by insurance company Marsh, which collected the data “from risk professionals from large and medium-size corporations from across the continent.”